CVE-2026-21767 MEDIUM

CVE-2026-21767: HCL BigFix Platform is affected by insufficient authentication

Vendor Hclsoftware

Product BigFix Platform

Weakness CWE-306 · Missing auth

Published April 1, 2026

Last update April 2, 2026

View on NVD All CVEs

CVSS base score

4.0/10

Attack vector Local

Attack complexity Low

Privileges required None

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

HCL BigFix Platform is affected by insufficient authentication. The application might allow users to access sensitive areas of the application without proper authentication.

Key dates

02Disclosure timeline

April 1, 2026 CVE published

April 2, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-21767 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/306.html

Related vulnerabilities

04Related CVE

CVE-2020-3461 Cisco Data Center Network Manager Information Disclosure Vulnerability CVE-2022-50977 Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via HTTP CVE-2023-45220 CVE-2024-3661 DHCP routing options can manipulate interface-based VPN traffic CVE-2026-35514 Unauthenticated Account Registration via /user/invited Bypasses All Signup Restrictions in Chartbrew